Traffic measurements and load characterizations are essential for the analysis and evaluation of network performance and for network design, capacity planning and cost optimization. Network loads can be characterized by identifying key traffic parameters which affect network sizing and performance, such as packet size distribution, packet throughput, and packet interarrival time distribution.
Studies have shown that since the early days of networking data, network traffic tends to be "bursty", rather than evenly distributed over time. Despite this fact, little work has been done to formally define burstiness and to develop models that adequately describe bursty traffic.
Traffic burstiness may be defined as the tendency of data packets to arrive in bursts, with the interpacket arrival time within the burst being much smaller than the average inter-packet arrival time. An appropriate measure of burstiness can serve as an important traffic parameter describing the variability in load intensity and packet arrival rate. Similar measures have been used in other scientific fields to characterize physical phenomena (e.g. errors in communication systems) where the variance in the occurrence of some events is too high to be considered random and when these events tend to occur in clusters.
Bursty traffic can have a significant effect on the queuing delays and response times of the communicating applications, since it can cause momentary capacity overloads from which the network must recover. Extended overloads contribute to network congestion and increase the probability of buffer overruns and discarding packets. Dropping packets to prevent extended overloads affects the quality of services and usually results in degraded performance. This is particularly true in Wide Area Networks (WANs) since the recovery from lost packets is costly in terms of time, generated traffic and processing.
In the past, there was not a great need for bursty traffic analysis. This is because network loads were light, queuing delays were minimal and the processing capabilities of computers limited their ability to admit bursty traffic into the networks. However, the introduction of high speed networking technologies and high performance personal computers and workstations, which are capable of transmitting packets at a very high rate, have increased dramatically the potential variability of network traffic. In addition, distributed systems, such as distributed database and network operating systems that use sophisticated protocols, such as Remote Procedure Call (RPC) and Network File System (NFS), have also contributed to the noticeable increase in traffic burstiness which, in turn, has increased queuing delays and response times. In addition to the variability in network load and packet arrival rates, packets transmitted by these systems are found to be highly correlated in that packets associated with the same application tend to arrive at the same destination over a short time period. This correlation is evident, for example, when a large file is transmitted from a file server to a diskless workstation.
Modeling bursty traffic utilizing traditional traffic or load models, such as a Poisson process, is difficult since the variance of this traffic is higher than that of the Poisson process. Even those models with a higher coefficient of variation, such as Hyperexponential, are still inadequate since they are unable to capture the correlation between packets. Correlation is an important characteristic of data traffic which usually affects the performance of network devices such as packet switches and gateways. Although traditional traffic models assume that packet arrivals are uncorrelated or independent, this assumption is no longer valid.
Few studies have been published describing algorithms and techniques for characterizing the burstiness of real network traffic. Most of the proposed algorithms are for off-line analysis and use iterative or trial-and-error methods to fit model parameters to the observed traffic. Such algorithms, however, are generally not suitable for real-time traffic characterization systems. It is therefore desirable to develop a real-time burstiness analysis capability within traffic characterization and monitoring systems.